Some users in the Gridcoin community have wondered who or what Pomegranate is because its two BOINC CPIDs have larger magnitudes than any other individual as of the writing of this article.
"Pomegranate" in this article refers to the following two CPIDs:
Before we begin, we, @dutch and @deltik, would like to apologize for jumping the gun on releasing conclusions to our findings without having obtained comment from the organization behind Pomegranate, Charity Engine. This was poor investigative reporting on our part.
We have since had a conference call with the founder of Charity Engine to address the concerns about Pomegranate.
Below in this article, we present only the facts from our investigation with no added sensationalization, speculation, opinions, commentary, analyses, or conclusions. Charity Engine did provide us with some proprietary or confidential information, which we have excluded from this article. We welcome the community to do what they want with the information provided.
Timeline
- On 13 August 2017, PrimeGrid sent Pomegranate 5000 GRC.
- On 21 August 2017, Pomegranate minted the 999998th Gridcoin block. @jringo announced that Pomegranate won the Gridcoin one millionth block commemorative coin.
- Two days after minting the block, Pomegranate as @pomegranatepool commented on @jringo's article asking how to claim the coin. @jringo and his team, including @dutch, proceeded to verify Pomegranate's identity via the Gridcoin blockchain so that Pomegranate could claim the commemorative coin.
- @jringo's team confirmed that a user called "pomegranatepool1" on the Gridcoin Slack channel controlled the Pomegranate wallet.
- On 28 August 2017, Pomegranate refunded PrimeGrid 2100 GRC.
- On 30 August 2017, Pomegranate refunded PrimeGrid 1700 GRC.
- In the month after minting the 999998th block, Pomegranate grew rapidly and amassed a magnitude greater than twice that of the largest individual Gridcoin user.
- We began trying to find out who Pomegranate was in early September 2017. @dutch tried to contact pomegranatepool1 for more information but received no response.
- On 11 September 2017, multiple Gridcoin community leaders had a meeting with some concerned users, including us. The users were concerned that Pomegranate's growth may have been too fast to be an individual or a pool of voluntary users like GRCPool.com.
- A Gridcoin community leader was able to get in contact with Pomegranate and reported to the meeting members that Pomegranate was a private company that wished to remain anonymous. This community leader declined to reveal any more information about the private company.
- A BOINC project admin informed the meeting members that Pomegranate was exclusively running BOINC 7.0.80.
- Pomegranate's hosts were not hidden on a different BOINC project called VGTU project@Home. This allowed us to see that Pomegranate was running BOINC 7.0.80 exclusively on that project, too.
- Another BOINC project, SRBase, discovered that some results were corrupt because of a bug with BOINC 7.0.80 and publicly asked those users to upgrade BOINC.
- We determined that BOINC never released a version 7.0.x release beyond version 7.0.65. Our Internet search revealed that the only software that matched BOINC 7.0.80 was Charity Engine 7.0.80. Search result samples: 1, 2
- We attempted to find a copy of Charity Engine 7.0.80, but the only download of the Charity Engine software that we could find was version 7.0.76, which could be downloaded after registering on the Charity Engine website.
- Should I Remove It? revealed that the majority of their users chose to remove Charity Engine and that the overall sentiment was negative, which led us to look into why that was.
- An analysis by Spyware Techie found that Charity Engine was bundled with other software.
- Our further Internet searches uncovered some press coverage of Charity Engine as a company but no testimonials of the Charity Engine software.
- Instead, our Internet searches for "Charity Engine," specifically the software, uncovered uninstall instructions, questions about what the software is, computer performance complaints, and infected computer help. Samples:
- On 08 December 2017, the first Pomegranate pool sent 14,994.73021000 GRC to the new, second Pomegranate pool.
- On 10 December 2017, we discovered the second Pomegranate pool and were alarmed by the second pool's growth. We chose to publicize our findings as soon as possible.
- @deltik wrote customized letters to all of the projects that Pomegranate was involved in to present the findings and suspicions drawn from the findings. In the conclusion of each letter, @deltik advised the projects to make their own determination on the appropriate action to take.
- @dutch wrote the initial public-facing Steemit article, currently titled "Investigating the Pomegranate Network Mining Gridcoin". That article was updated on 17 December 2017 following feedback from Charity Engine.
Q&A
The Gridcoin community posed questions to Charity Engine in the hopes of understanding what made their network legitimate and ethical. The answers that Charity Engine provided are reproduced in this section.
What is an example of an ad that leads to a Charity Engine 7.0.80 download? Despite a greater than 99% acquisition through ads, our searching has turned up nothing.
Charity Engine informed us that the advertisements that they run are through software bundling providers. They said that all software bundling plans are strictly opt-in, meaning when the bundle installer is running, the user must agree to the installation of Charity Engine.
They also said that they do not have the choice of what software they are bundled with. As they did not choose the bundling packages, they did not have an example ad to show us during our meeting with them.
Charity Engine 7.0.80 reports its own release date as 07 March 2014 (source). Why did it take so long to announce an upcoming update on 12 December 2017?
Charity Engine explained that there has not been a need to update the software because the BOINC tasks that it was running were being completed as expected.
The details of the upcoming version are confidential.
Why hasn't there been an update the last 3½ years since the severe vulnerability CVE-2013-2298, which affects Charity Engine 7.0.80?
We were the first to inform Charity Engine of CVE-2013-2298. They have taken note of this as a bug report.
We have seen that Charity Engine 7.0.80 users exclusively run Microsoft Windows but not Windows 10, and the hardware tends to be older or obsolete. Why does the typical Charity Engine user profile look like this?
Regarding the lack of Windows 10, Charity Engine explained that it is a bug with the operating system reporting functionality of Charity Engine 7.0.80: Windows 10 gets reported as Windows 8.1 or an earlier version.
As for the older hardware, Charity Engine said their target users are not tech-savvy, so they install Charity Engine as part of an opt-in software bundle without minding what kind of hardware they are running.
Another independent investigation found that Charity Engine is bundled with other programs and may be installed without the users noticing. Can you walk us through the installation flow of a Charity Engine software bundle?
Charity Engine reported that they do not have control over how their software is bundled, so they did not have a sample bundle to show us.
Why is Pomegranate called Pomegranate?
Charity Engine said that they intentionally chose a name unrelated to themselves so that Gridcoin users would not fear a network takeover by the large compute capacity of Charity Engine.
On 12 December 2017, why did you rename the second Pomegranate pool from "pomegranate2" to "PSVR-1075" and then later rename it back to "pomegranate2"?
The Charity Engine representative we met with said he was unsure because his developer made the change. He postulated that it was a mistake on the developer's part.
We expect to see a lot of active users if there are over 460,000 hosts in 2016, but the Charity Engine forum is almost dead. Where is the community talking about Charity Engine?
Charity Engine explained that the vast majority of their users do not care about what happens on Charity Engine after the software is installed. They figure that the users just trust that the software does what it needs to do.
We asked for additional information about how the users relate to the prize drawings featured on Charity Engine's website. Charity Engine replied that the vast majority of their users do not care to check out the prize drawings (or even sign up to the Charity Engine website) despite installing the Charity Engine software. They are content knowing they are helping the scientific community at no cost to themselves.
Beyond that, the Charity Engine founder emphasized that his primary goal for Charity Engine was to contribute to scientific BOINC projects. The donations to charity are an added bonus, and there is little interest in the prize drawing system.
Why aren't people talking about Charity Engine? There is hardly a peep about Charity Engine on social media.
Charity Engine admitted that their social media campaigns have been a complete let-down. We were able to find ample evidence to support this. Their blog has a story on the social media failure.
To reiterate, Charity Engine reported that the vast majority of their users merely install the software and let it run.
When users like our test account or this guy try to do work for Charity Engine 7.0.76 (the public version), we get what appears to be a dummy task taking up "0.0001 CPU" and using very little CPU. Why can't we voluntarily contribute to Charity Engine through the client?
Charity Engine informed us that they have a large amount of unused capacity. They provided multiple reasons why, paraphrased below:
- When looking for projects to add idle compute resources to, they must vet the projects to ensure that the projects are compatible.
- They contact BOINC projects before adding their compute resources to ensure that the BOINC servers can handle the load of the potentially tens of thousands of hosts that can contribute to the desired projects.
- A historically incompatible project example was Rosetta@home. The project's tasks consumed too much RAM, which slowed down users' computers. As a result, many users uninstalled Charity Engine.
- If Charity Engine donated their large compute power to BOINC projects in Lithuania, the project admins would have to pay a hefty gift tax, so Charity Engine opted not to donate large amounts of compute to Lithuania based projects.
- The user turnover rate increases when more compute resources are used. To sustain their current turnover rate of 0.75% per day, Charity Engine must constantly feed marketing spending on bundled software packages to get new installs, therefore maintaining their user base.
Since Charity Engine, like BOINC, cannot update itself, how will the users who just leave Charity Engine 7.0.80 running update to the upcoming new release?
The plan that Charity Engine described works as follows: When the new version is released to bundled software distributors, it will replace the constantly overturning old versions. Charity Engine estimates that 90% of existing users today will have been replaced by new users in roughy six months.
Why did Pomegranate participate in yoyo@home, a project that requires strong authenticators? This means that the Pomegranate account password on yoyo@home was being deployed to some users' computers.
Charity Engine did not provide an answer to this question; however at the time of writing, Pomegranate has practically stopped earning credit on yoyo@home.
PrimeGrid (address S6RimEgrEar84vQpsmVAVFbGkxfJ4i2sec) provided funds to get Pomegranate started. What is PrimeGrid's role in Pomegranate?
Charity Engine explained that Rytis from PrimeGrid had two Gridcoin wallets and mistakenly sent Pomegranate the GRC from the PrimeGrid Gridcoin donations instead of Rytis's personal balance of GRC.
PrimeGrid consequently was the project with the least return from Pomegranate despite providing the initial wallet funds. Why is Pomegranate not contributing compute power to PrimeGrid?
Charity Engine said that they did contribute a significant amount of custom work for PrimeGrid but greatly reduced their contributions to avoid the possibility of subjecting PrimeGrid to a Lithuanian gift tax.
Can you provide your earnings reports and charity donations so that we can verify your 33-33-33 income distribution claim?
Charity Engine said that this is something they can look into doing moving forward.
(Thanks to @guk for this question) From July to August 2014, Charity Engine added about 125,000 new users to Rosetta@home, which had about 25,000 users at the time. Although Rosetta@home's user count increased fivefold, BOINCstats recorded no substantial change in the rate of issued credit around August 2014. Why is that?
Charity Engine did not have a solid explanation for this discrepancy. They speculated that there is a reporting error to BOINCstats for Charity Engine's contributions to Rosetta@home.
We consider this article to bring our investigation to a close.
If you have any further questions about the investigative process, you are invited to contact @deltik or @dutch on Steemit, Reddit or Slack. For other questions about Charity Engine or Pomegranate, Charity Engine can be contacted through their website.
Thanks for reading!
Regards,
Deltik and Dutch